CVE-2026-124028 mistral.rs before 0.9.5 Tool Call Injection via mistralrs-core Output Parsers

mistral.rs before 0.9.5 contains a delimiter injection vulnerability in mistralrs-core that allows attackers to inject tool calls by placing delimiter strings in text the model quotes. Attackers controlling documents, web pages or tool outputs can embed tags like to make qwen-xml, gemma4 or...

CVE-2026-124028 mistral.rs before 0.9.5 Tool Call Injection via mistralrs-core Output Parsers

mistral.rs before 0.9.5 contains a delimiter injection vulnerability in mistralrs-core that allows attackers to inject tool calls by placing delimiter strings in text the model quotes. Attackers controlling documents, web pages or tool outputs can embed tags like to make qwen-xml, gemma4 or...

CVE-2026-124028 mistral.rs before 0.9.5 Tool Call Injection via mistralrs-core Output Parsers

mistral.rs before 0.9.5 contains a delimiter injection vulnerability in mistralrs-core that allows attackers to inject tool calls by placing delimiter strings in text the model quotes. Attackers controlling documents, web pages or tool outputs can embed tags like to make qwen-xml, gemma4 or...

LXD has arbitrary file write on host via `exec-output` symlink in crafted image

Reported from https://github.com/lxc/incus/security/advisories/GHSA-48q5-w887-33wv Summary The record-output parameter of the /instances/$name/exec endpoint stores the output of the command in the exec-output directory of the instance. If exec-output is a symlink, file named execUUID.stdout and...

GHSA-9J25-MM2H-2F76 LXD has arbitrary file write on host via `exec-output` symlink in crafted image

Reported from https://github.com/lxc/incus/security/advisories/GHSA-48q5-w887-33wv Summary The record-output parameter of the /instances/$name/exec endpoint stores the output of the command in the exec-output directory of the instance. If exec-output is a symlink, file named execUUID.stdout and...

EUVD-2026-118388

Kroki creates diagrams from textual descriptions. From 0.26.0 until 0.31.2, the optional Mermaid companion's mermaid/src/worker.js renders attacker-controlled flowchart image nodes in headless Chromium without a network request policy, even when KROKISAFEMODE is set to secure. An actor who can...

CVE-2026-102356 Kroki Mermaid companion SSRF via flowchart image URLs

Kroki creates diagrams from textual descriptions. From 0.26.0 until 0.31.2, the optional Mermaid companion's mermaid/src/worker.js renders attacker-controlled flowchart image nodes in headless Chromium without a network request policy, even when KROKISAFEMODE is set to secure. An actor who can...

CVE-2024-52318

CVE-2024-52318 🚨🚨CVE-2024-52318 - Apache Tomcat XSS Vulnerability in Generated JSPs🚨🚨 Overview CVE-2024-52318 is a crosssite scripting XSS vulnerability in Apache Tomcat, which arises from improperly released resources in generated JavaServer Pages JSPs. This issue, introduced by a prior...

CVE-2026-123665

A weakness has been identified in kubescape up to 4.0.15. Impacted is the function GetWriter of the file core/pkg/resultshandling/printer/printresults.go of the component Output. Executing a manipulation of the argument outputFile can lead to permission issues. The attack requires local access...

EUVD-2026-118274

A weakness has been identified in kubescape up to 4.0.15. Impacted is the function GetWriter of the file core/pkg/resultshandling/printer/printresults.go of the component Output. Executing a manipulation of the argument outputFile can lead to permission issues. The attack requires local access...

CVE-2026-123665

A weakness exists in kubescape versions up to 4.0.15 within the Output component. Specifically, the GetWriter function in the file core/pkg/resultshandling/printer/printresults.go is susceptible to manipulation of the outputFile argument. This flaw can lead to permission issues (CWE-275, CWE-266)...

CVE-2026-123665 kubescape Output printresults.go GetWriter permission

A weakness has been identified in kubescape up to 4.0.15. Impacted is the function GetWriter of the file core/pkg/resultshandling/printer/printresults.go of the component Output. Executing a manipulation of the argument outputFile can lead to permission issues. The attack requires local access...

CVE-2026-123665 kubescape Output printresults.go GetWriter permission

A weakness has been identified in kubescape up to 4.0.15. Impacted is the function GetWriter of the file core/pkg/resultshandling/printer/printresults.go of the component Output. Executing a manipulation of the argument outputFile can lead to permission issues. The attack requires local access...

log4shell

log4shell Python Script to scan the server file system for log4j jars that are vulnerable to CVE-2021-44228 and CVE-2021-45046. The script recursively goes through the file system including zip, ear, war to find log4j versions 2. to 2.15 with org/apache/logging/log4j/core/lookup/JndiLookup.class...

CVE-2022-23861

CVE-2022-23861: Multiple Stored Cross-Site Scripting in YSoft SafeQ Multiple fields in the YSoft SafeQ web application can be used to inject malicious inputs that, due to a lack of output sanitization, result in the execution of arbitrary JS code. These fields can be leveraged to perform XSS...

CVE-2026-120035

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'itemtitle parsed from feed ' parameter in all versions up to, and including, 5.2.13 due to insufficient input sanitization an...

CVE-2026-119178

The Smart Cookie Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

osint-pattern-analyzer

OSINT Pattern Analyzer Tool for automating OSINT investigations across multiple identity vectors phone numbers, usernames and future email support, designed to extract structured data and enable pattern detection and correlation analysis. Features Phone OSINT Search phone numbers across multiple...

naga

naga malware detonation..actually running in debug/verbose mode .. video-1 https://github.com/user-attachments/assets/40a30755-164e-4b7d-a1d7-b0df4ea20d1b shot-1 shot-2 shot-3 shot-4...

CVE-2026-120035

The RSS Aggregator by Feedzy WordPress plugin (versions <= 5.2.13 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the item_title parameter, which is parsed from a feed's tag. An unauthenticated attacker can inject...